How to Configure a Firewall: UFW and iptables

What Is a Firewall?

A firewall is the gatekeeper that decides which network traffic enters your server and which gets blocked. Without a firewall, every port on your server is open to anyone on the internet. This means every service running on your server — from the database to the mail server — is accessible to the world.

The statistic: A server without a firewall receives an average of 2,000 intrusion attempts daily. After enabling a firewall: fewer than 50.

UFW: The Simple Choice

UFW (Uncomplicated Firewall) is a simplified interface for iptables. Installed by default on Ubuntu and available on most Linux distributions.

Basic Setup

# Enable UFW
sudo ufw enable

# Default policy: deny all incoming
sudo ufw default deny incoming

# Default policy: allow all outgoing
sudo ufw default allow outgoing

Opening Essential Ports

# SSH (change the number if you changed the port)
sudo ufw allow 2222/tcp

# HTTP
sudo ufw allow 80/tcp

# HTTPS
sudo ufw allow 443/tcp

Advanced Rules

# Allow from specific IP only
sudo ufw allow from 192.168.1.100 to any port 3306

# Allow entire subnet
sudo ufw allow from 10.0.0.0/24 to any port 22

# Block specific IP
sudo ufw deny from 203.0.113.50

# Rate limit connections (brute-force protection)
sudo ufw limit 2222/tcp

Managing Rules

# Show rules with numbers
sudo ufw status numbered

# Delete rule by number
sudo ufw delete 3

# Reset all rules
sudo ufw reset

# Enable logging
sudo ufw logging on

Complete Web Server Example

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw limit 2222/tcp comment 'SSH rate limit'
sudo ufw enable

iptables: Full Control

iptables is the native Linux firewall. More powerful and more complex than UFW — it gives you full control over every aspect of network traffic.

Core Concepts

Chains:

• INPUT — Traffic coming to the server
• OUTPUT — Traffic leaving the server
• FORWARD — Traffic passing through the server (routing)

Targets:

• ACCEPT — Allow the traffic
• DROP — Silent rejection (no response)
• REJECT — Rejection with error message
• LOG — Record to logs

Basic Setup

# Flush all existing rules
sudo iptables -F

# Default policies
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow localhost
sudo iptables -A INPUT -i lo -j ACCEPT

# SSH
sudo iptables -A INPUT -p tcp --dport 2222 -j ACCEPT

# HTTP + HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Advanced Rules

# SYN Flood protection
sudo iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j ACCEPT

# Block ping (optional)
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

# SSH connection limit (brute-force protection)
sudo iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

# Log dropped packets
sudo iptables -A INPUT -j LOG --log-prefix "IPTables-Dropped: " --log-level 4

Saving Rules

# Ubuntu/Debian
sudo apt install iptables-persistent -y
sudo netfilter-persistent save

# CentOS/AlmaLinux
sudo service iptables save

Comparison: UFW vs iptables

Criteria	UFW	iptables
Ease of use	Very easy	Advanced
Flexibility	Medium	Full
Best for	Single web server	Complex networks
Learning curve	One hour	Days
Performance	Identical	Identical
IPv6	Supported	Requires ip6tables

Recommendation: Start with UFW. If you need finer control — move to iptables.

Common Mistakes

1. Locking yourself out — Ensure SSH port is open before enabling the firewall
2. Forgetting to save rules — iptables rules are lost after reboot without saving
3. Opening too many ports — Only open what you need
4. Ignoring IPv6 — Attackers use IPv6 if IPv4 is protected
5. Not reviewing rules — Review your rules monthly

Firewall on Strong Infrastructure

CLOUD (cloud.net.sa) servers come ready for UFW or iptables configuration from the first moment. With DDoS protection as an add-on at affordable pricing, your server is protected at both the network and system level. Start by configuring your firewall — the first step after receiving any server.

---

Get Started

Need a secure environment? Choose a protected server with DDoS protection and advanced firewall. Review our SLA and Privacy Policy.